docs: def verify_manifest_entry_checksums(self, manifest, strict=True):
          """
          Verifies the checksums over the given manifest. If strict is True
          then entries which had no digests will fail verification. If
          strict is False then entries with no digests will not be
          considered failing.
  
          :return: List of entries which failed to verify.
  
          Reference:
          http://docs.oracle.com/javase/7/docs/technotes/guides/jar/jar.html#Signature_Validation
          """
  
          # TODO: this behavior is probably wrong -- surely if there are
          # multiple digests, they should ALL match, or verification would
          # fail?
  
          failures = []
  
          for s in manifest.sub_sections.values():
              sf_section = self.create_section(s.primary(), overwrite=False)
  
              digests = s.keys_with_suffix("-Digest")
              if not digests and strict:
                  failures.append(s.primary())
                  continue
  
              for java_digest in digests:
                  section_digest = b64_encoded_digest(
                      s.get_data(manifest.linesep),
                      _get_digest(java_digest))
  
                  if section_digest == sf_section.get(java_digest + "-Digest"):
                      # found a match, verified
                      break
              else:
                  # no matches found for the digests present
                  failures.append(s.primary())
  
          return failures